{"id":"ASB-A-273995284","details":"In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-273995284","CVE-2025-22435"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/efa5f4ef386a8947f4777840c5cefff389740e86"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6","target":{"file":"system/stack/avdt/avdt_msg.cc","function":"avdt_msg_ind"},"deprecated":false,"digest":{"function_hash":"17364776682207328621562279625673091583","length":3934},"id":"ASB-A-273995284-12dafa76","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69968497529221303174354349176262428972","289267339819583124441987779324406424110","210875894870981578955181235640352806598","232881515703603029002002586106176935855","298765360413203219284747084932649921103"]},"id":"ASB-A-273995284-42699ed1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","target":{"file":"system/stack/avdt/avdt_msg.cc"}},{"deprecated":false,"digest":{"function_hash":"101213322258309175509044928261249359797","length":3611},"id":"ASB-A-273995284-bfe867b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6","target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"line_hashes":["291121899986190632954558531092622720636","145485880068509586563865574044950578055","236604861184405476897001877115365783460","162556421373855455052121016183079354238","283785321425543417081153347573944754301","314592963219822661814482431325513627637","213375627068001655805525833708755971092","60345347931178594599383642155093729954","232881515703603029002002586106176935855"],"threshold":0.9},"id":"ASB-A-273995284-f994d855"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"function_hash":"101213322258309175509044928261249359797","length":3611},"id":"ASB-A-273995284-9293aa9c","signature_type":"Function"},{"target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","232881515703603029002002586106176935855","298765360413203219284747084932649921103"],"threshold":0.9},"id":"ASB-A-273995284-b98f9140","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"system/stack/avdt/avdt_msg.cc","function":"avdt_msg_ind"},"deprecated":false,"digest":{"length":3591,"function_hash":"275031440224446623701712737192977390752"},"id":"ASB-A-273995284-4914368b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"},{"digest":{"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","127072241333684706305506437777635863312","96166965579290052119536940010839083498"],"threshold":0.9},"id":"ASB-A-273995284-a54c81d4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"],"severity":"High","spl":"2025-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","127072241333684706305506437777635863312","96166965579290052119536940010839083498"],"threshold":0.9},"id":"ASB-A-273995284-111d86fe","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"},{"id":"ASB-A-273995284-5397f643","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","target":{"file":"system/stack/avdt/avdt_msg.cc","function":"avdt_msg_ind"},"deprecated":false,"digest":{"length":3591,"function_hash":"275031440224446623701712737192977390752"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"],"severity":"High","spl":"2025-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}}],"schema_version":"1.9.0"}